How Indonesia is strengthening security across its digital health ecosystem

This story is part of GovInsider's Digital Trust & Cybersecurity Champions 2026 Special Report. 

Health data is among the most sensitive information a person possesses. When that data flows between different facilities through a national platform, a single security vulnerability can have far-reaching consequences.

Indonesia’s Ministry of Health has made security a core requirement in developing SATUSEHAT, a digital health ecosystem established in 2021, that also supports the national Free Health Screening (CKG) programme. 

The Ministry’s Head of Centre for Data and Information Technology (Pusdatin), Eko Sulistijo, says that while security may not be perceived most obvious in achieving a health programme’s targets, it remains essential to the programme’s success. 

“Without security, everything becomes less meaningful,” Sulistijo tells GovInsider. 

He says that the importance of cybersecurity is continually emphasised to stakeholders across the healthcare sector. 

As part of Indonesia’s critical information infrastructure, the cybersecurity for SATUSEHAT needs to go beyond technical safeguards.  

It must also include systems management, inter-agency coordination, and preparedness for emerging threats. 

According to Sulistijo, his team’s approach rests on three principles: building security into systems from the outset, treating it as a shared responsibility, and strengthening safeguards to address new tech developments like artificial intelligence (AI). 

Building security in from the start 

The first principle is making security an integral requirement throughout the system development process, rather than treating it as a final checkpoint.

The Pusdatin is beginning to adopt the shift-left approach, which involves addressing security considerations from the earliest stages of the system’s design and development.  

If a vulnerability is identified during this process, development does not proceed until the issue has been addressed. 

“The process will be halted and returned to an earlier stage until the security requirements have been met,” Sulistijo explains. 

But meeting security requirements before launching is not enough. Operational systems also require ongoing maintenance and monitoring to address new vulnerabilities. 

Developers and system operators must ensure that security patches are applied, while security teams continue to provide advice on system security and data management, he adds. 

The SATUSEHAT Mobile and SATUSEHAT Platform currently follow the ISO 27001:2022 and ISO 27799:2016 cybersecurity standards. 

This security-by-design approach is particularly important because SATUSEHAT connects with various other health information systems. 

This means that one system’s security depends on safeguards implemented by others. 

Strengthening the security chain 

According to Sulistijo, even systems that meet security standards remain exposed to risks when connected to other systems with weaker safeguards. 

“When managing security, we must not only ensure the security of our own systems, but also ensure that other connected systems maintain the same security standards,” he notes. 

Health information systems seeking to integrate with SATUSEHAT must implement security controls at both the application and organisational levels. 

The Minister of Health Decree and Personal Data Protection Law emphasised the need for clear allocation of responsibilities within the ministry. 

The decree sets out the responsibilities of individual units in safeguarding personal data. 

Beyond establishing responsibilities, the ministry is also strengthening its capacity to respond when existing safeguards fail to prevent an incident. 

It operates two cyber incident response teams: the MoH-CSIRT, which serves the ministry as an organisation, and Health CSIRT, which supports cybersecurity management for the health sector. 

A joint circular issued by the Minister of Health and the National Cyber and Crypto Agency (BSSN)’s head also requires electronic system operators to establish computer security incident response teams (CSIRTs).  

These teams support incident response coordination both horizontally between organisations, and vertically across different levels of government. 

Sulistijo says this requirement calls for continuous capacity-building to ensure teams can respond to threats according to their severity and potential impact.  

The ministry works with BSSN to provide technical training, cyber drills, and tabletop exercises. 

Such preparedness matters because security is measured not only by the ability to prevent attacks, but also by the capacity to maintain services and restore them when incidents occur. 

“Potential incidents and risks cannot always be avoided, but we must always be prepared to face them.” 

Protecting legacy systems while enabling change 

Incident preparedness depends on the infrastructure supporting digital health services.  

Not every system can be replaced immediately with newer technology, and legacy systems must continue operating while remaining secure.

Sulistijo says the ministry’s approach is to use cloud infrastructure for flexibility and scalability, while retaining legacy systems as an anchor of stability and making security the shared foundation. 

Adopting cloud does not automatically require existing systems to be abandoned. The ministry continues to limit risks to legacy systems through one-way isolation and strict segmentation. 

“We do not simply isolate legacy systems and leave them behind; we manage them through one-way isolation and strict segmentation,” he explains. 

To strengthen data resilience, the ministry uses immutable cloud backups to protect on-premises systems.  

Disaster recovery plan (DRP) simulations are also conducted regularly to test the ministry’s ability to restore services. 

Over time, critical workloads are being moved gradually to a more secure and scalable cloud environment. 

Building a culture of security 

Sulistijo emphasises that infrastructure and technical procedures can provide optimal protection only when supported by the people operating them.

“We view cyber resilience as a shared responsibility,” he says, adding that the ministry is working to ensure cybersecurity is understood as more than just the IT team’s responsibility. 

To raise awareness, Pusdatin publishes an information security awareness flyer every month.  

Personal data protection measures have also been extended to all work units, while information security management guidelines have so far been only implemented partially. 

The ministry is now working to extend these guidelines across the entire organisation, aiming to provide a reference for other health information system operators. 

AI and defence in depth 

As AI adoption expands in the health sector, Sulistijo highlights a shift in security priorities: attention must extend beyond the systems to the data being processed by machines. 

Security measures must now go beyond application protection to encompass data protection, access controls, technology governance, and preparedness for cyber incidents. 

Pusdatin operates a Security Operations Centre (SOC) that monitors threats around the clock. Together with the CSIRTs, it prepares mitigation measures in case an incident occurs. 

The ministry has also established an AI Committee to oversee ethical, legal, and data security considerations in the use of AI. 

“Collaboration between cyber incident response teams and the AI Committee can establish defence in depth, addressing not only cybersecurity but also the security of the data involved,” he says. 

Through this approach, AI needs to operate according to the principles of security, privacy, and accountability. 

“The principle is that security and data protection must be the foundation, not a barrier to innovation,” says Sulistijo. 

Pusdatin is also assessing emerging threats. It is developing a quantum computing readiness roadmap with BSSN, beginning with reassessing assets based on the data they handle. 

The success of digital health transformation depends on how safely, reliably, and responsibly technology delivers benefits to the public, he concludes.